Re: Firewall grayed out in xp after gpupdate /force

Magnetoram wrote:
Thanks for the post, where would I find the standard profile policies?


It's at the same hierarchical level as the Domain Profile in the Group
Policy.


"kj" wrote:

Magnetoram wrote:
When the laptop is connected to the domain I am able to turn the
firewall on and off. When it is not connected to the domain the on
or off option is greayed out

Then check the GPO settings for the Standard Profile policies. I
don't think there's an option in local policy for it, but that would
be the only other place where Policy is controling this setting.


"kj" wrote:

Magnetoram wrote:
Thanks, I will try next time the client comes in the office


If this is a laptop then be aware there are two different policies.
Domain and Standard Profiles for the Windows Firewall. I think Dave
posted some troublshooting for NLA and Windows Firewall a while
back.


"kj" wrote:

Magnetoram wrote:
I turned it off with GP. I can turn the fw on and off on some of
the machines but not on the one I mentioned. It is grayed out

It is still under control of group policy then. try another
gpudate /force. Then check for event log entries about group
policy failures.


"kj" wrote:

Magnetoram wrote:
Thanks for the post. I did disable it using GP. I am not sure
what you mean

Maybe I don't know what you mean either.

If you enable the firewall settings in a Group Policy Object
and then "enable" that policy to be applied to computers, then
the firewall settings will be forced ON and you will not be
able to disable it using the workstation GUI. (Greyed out)

If you disable the firewall settings in a Group Policy Object
and then "enable" that policy to be applied to computers, then
the firewall settings will be forced OFF and you will not be
able to enable it using the workstation GUI. (Greyed out)

There is no middle ground regarding group policy. It's ON or
OFF or "not defined". If it's "not defined" then an
Administrator of the computer can set it on or off at their
discretion and it;s not under the control of Group Policy.
(Not Greyed out)

Perhaps clarify which of the above matchs your situation.


"kj" wrote:

Lanwench [MVP - Exchange] wrote:
Magnetoram <Magnetoram@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
I have disabled the firewall using group policy and
gpupdate /force One machine when not connected to the
domain has the firewall enabled and is grayed out so I
cannot disable it. I updated the group policy and disabled
the firewall while connected to the domain. I need to be
able to enable and disable while the client is using
certain software.

In addition to KJ's excellent advice - don't disable it for
software; set exceptions as needed (either locally or via
GPO).

Any software
that insists you disable your firewall is software to avoid.

Truer words were (almost) never (written) spoken Lanwench.
--
/kj

--
/kj

--
/kj

--
/kj

--
/kj

--
/kj


.

Relevant Pages

  • Re: [fw-wiz] httport 3snf
    ... > Having worked in the Firewall support role at several companies, ... I had my CIO approve my security policy. ... time educating him about Internet risk. ... There's also a very good "at what point is the firewall now useless" ...
    (Firewall-Wizards)
  • RE: Sandboxing
    ... the 3Com Embedded Firewall would be extremely useful and enabling (in ... your case) when you look at it in a VPN context. ... This security policy will accomplish quite a few things: ... During the Policy Server installation, ...
    (Focus-IDS)
  • Re: server firewall
    ... If you want to disable personal firewall settings locate the policy that is ... Refresh the policy on the clients once you are done editing it. ...
    (microsoft.public.windows.server.setup)
  • Re: Questions About Windows Firewall and Domain Policy Enforcement
    ... Can you please provide me with more detail with what you mean by connecting ... configure the firewall, namely group policy, net shell scripts, manual ... You can do this through group policy or a login script. ... > as there is no Standard Profile configured. ...
    (microsoft.public.win2000.group_policy)
  • Re: Questions About Windows Firewall and Domain Policy Enforcement
    ... Can you please provide me with more detail with what you mean by connecting ... configure the firewall, namely group policy, net shell scripts, manual ... You can do this through group policy or a login script. ... > as there is no Standard Profile configured. ...
    (microsoft.public.windows.group_policy)